VisionWaves Security Overview

• •A designated security lead owns the security program and reports risk to leadership
• •Documented information security policies covering access control, acceptable use, data classification, and incident response and is version-controlled
• •Annual review of policies and this Security Overview, with updates communicated to customers on material change

• •Production infrastructure hosted with public cloud providers or on customer premises, depending on the deployment model agreed with the customer
• •Logical separation between customer environments/tenants; no customer has direct access to another customer's data
• •Infrastructure changes go through version control and a documented change-management process

• •All data transmitted between customer, VisionWaves, and the Services is encrypted using TLS 1.2 or higher
• •Internal service-to-service traffic within the production environment is also encrypted, not only customer-facing connections
• •Certificates are issued and rotated through a managed certificate process; weak or deprecated cipher suites are disabled
• •API access requires authenticated, encrypted connections; unencrypted endpoints are not exposed for production traffic

• •Data is encrypted at rest using industry-standard algorithms (e.g., AES-256) across databases, object storage, and backup volumes
• •Backups are encrypted using the same standard as production data and tested periodically for restorability
• •Encryption keys are managed through KEY MANAGEMENT APPROACH, with restricted access to key material and periodic key rotation
• •Logs and telemetry that may contain customer data are subject to the same at-rest encryption and access controls as primary data stores

• •Access to production systems and customer data is role-based and follows least-privilege
• •Multi-factor authentication required for administrative and remote access
• •Access is reviewed periodically and revoked promptly upon role change or termination
• •All privileged access is logged and retained for security monitoring

• •Secure development lifecycle including code review before production deployment
• •Dependency and vulnerability scanning integrated into the build pipeline
• •Periodic penetration testing by a qualified third party
• •Staging and production environments are separated; production data is not used in lower environments without safeguards

• •AI features delivered through x101 orchestration are subject to a documented review process before release, including evaluation of accuracy, reliability, and appropriate use cases
• •Material changes to underlying models or orchestration logic go through the same change-management process as other production changes, including customer notice where the change could materially affect output behavior
• •AI-assisted features are designed for human review of consequential outputs; VisionWaves does not represent that AI outputs are a substitute for professional, legal, financial, or safety judgment
• •Where third-party foundation models are used to deliver AI features, those providers are engaged as subprocessors under contractual confidentiality and data-protection terms — see Section 13 (Subprocessor and Vendor Security) and the current subprocessor list for named providers
• •An internal AI acceptable-use policy governs how employees may use AI tools with company or customer data

• •Customer data submitted through the Services is not used to train shared or general-purpose models unless the customer has opted in in writing
• •Model tuning or fine-tuning performed for a specific customer is scoped to that customer's environment and data only
• •Prompts, outputs, and related data processed through x101 orchestration are handled under the same access controls and encryption standards as other customer data

• •Centralized logging and monitoring of production systems for anomalous activity
• •Documented incident response plan with defined severity levels and escalation paths
• •Customer notification of confirmed Personal Data Breaches without undue delay and within 72 hours of confirmation, consistent with the Data Processing Agreement

• •Regular, encrypted backups of production data with periodic restoration testing
• •Documented disaster recovery plan with defined recovery time and recovery point objectives

• •Vulnerabilities triaged and remediated according to severity, with critical issues prioritized
• •Systems and dependencies kept current through a regular patching cadence

• •Background checks for employees consistent with local law and role sensitivity
• •Security and data-handling training at onboarding and on a recurring basis
• •Confidentiality obligations included in employment and contractor agreements

• •Subprocessors — including infrastructure, hosting, and third-party AI model providers — are evaluated for security posture before engagement
• •Data-protection and confidentiality obligations are contractually imposed on subprocessors
• •A current subprocessor list, including any third-party model providers, is available on request at security@visionwaves.com

• •VisionWaves aligns its industry practices and holds GDPR, SOC 2 Type II aligned, and ISO 27001

Security questions, vulnerability reports, or requests for the current subprocessor list can be sent to security@visionwaves.com.